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IN THE CLAIMS: 

1 . (Original) A method for filtering content, comprising: 
assigning point values to a plurality of keywords; 
receiving a first plurality of documents from a source; 

comparing text of each of the first plurality of documents with the plurality of 
keywords; 

calculating a score for each of the first plurality of documents based on the point 
value$ and the results of the comparison; 

calculating an first average of the scores for the first plurality of documents; and 
blocking access to the source if the first average score exceeds a threshold. 

2. (Original) The method of claim 1 , wherein the keywords and corresponding point 
values are stored in a keyword search table. 

3. (Original) The m ethod of claim 1 , wherein the step of blocking access to the 
source comprises entering a known-block rule in a rules table, tbe known-block rule 
indicating that the source is to be blocked. 

4. (Original) The method of claim 1, further comprising: 

entering a known-safe rule in a rules table if the first average score does not 
exceed the threshold, the known-safe rule indicating that access to the source is to be 
permitted. 

5. (Original) The method of claim 1 , further comprising: 

if the first average score does not exceed the threshold, performing the following 

steps: 

receiving a second plurality of documents from a source; 
comparing text of each of the second plurality of documents with the 
plurality of keywords; 
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calculating a score for each of the second plurality of documents based on 
the point values and the results of the comparison; 

calculating an second average of the scores for the second plurali ty of 
documents; and 

blocking access to the source if the second average score exceeds a 
threshold. 

6. (Original) The method of claim 1, wherein the method is performed in a firewall. 

7. (Currently amended) A method for filtering content, comprising: 
assigning point values to a plurality of keywords; 

receiving a request for a document from a client; 
receiving the document from a source; 

comparing text of e aehof the plurality of documents the document with the 
plurality of keywords; 

calculating a score for the document based on the point values and the results of 
the comparison; 

determining if a decision interval has been reached; 

calculating an average score over the decision interval if the decision interval has 
been reached for the source; and 

blocking access to the source if the average score exceeds a threshold. 

8. (Original) The method of claim 7, wherein the keywords and corresponding point 
values are stored in a keyword search table. 

9. (Original) The method of claim 7, wherein the decision interval is a length of 
time. 

10. (Original) The method of claim 7, wherein the decision interval is a number of 
documents. 
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1 1 . (Original) The method of claim 7, wherein the step of blocking access to the 
source comprises entering a known-block rule in a rules table, the known-block rule 
indicating that the source is to be blocked. 

1 2. (Original) The method of claim 7, further comprising: 

entering a known-safe rule in a rules table if the first average score does not 
exceed the threshold, the known-safe rule indicating that access to the source is to be 
permitted. 

13. (Original) The method of claim 7, further comprising: 

passing the document to the client if the decision interval has not been reached. 

14. (Original) The method of claim 7, further comprising: 

passing the document to the client if the first average score does not exceed the 
threshold. 

15. (Original) An apparatus for filtering content, comprising: 
assignment means for assigning point values to a plurality of keywords; 
receipt means for receiving a first plurality of documents from a source; 
comparison means for comparing text of each of the first plurality of documents 

with the plurality of keywords; 

calculation means for calculating a score for each of the first plurality of 
documents based on the point values and the results of the comparison; 

averaging means for calculating an first average of the scores for the first plurality 
of documents; and 

blocking means for blocking access to the source if the first average score exceeds 
a threshold. 

1 6. (Original) The apparatus of claim 15, wherein the keywords and corresponding 
point values are stored in a keyword search table. 



Page 4 of 17 
Gusler et al. - 09/735,589 

PAGE 6/19 * RCVD AT 10/612004 2:03:53 PM [Eastern Daylight Time] * SVR:ilSPTO-EFXRF-1/0 * DNIS:8729306 ' CSID:9723672008 * DURATION (mm-5S):05-20 



10/06/2004 13:01 9723672008 



YEE & ASSOCIATES 



PAGE 



1 7. (Original) The apparatus of claim 1.5, wherein the blocking means comprises 
means for entering a known-block rule in a rules table, the known-block rule indicating 
that the source is to be blocked 

18. (Original) The apparatus of claim 15, further comprising: 

means for entering a known-safe rule in a rules tabl e if the first average score 
does not exceed the threshold, the known-safe rule indicating that access to the source is 
to be permitted. 

19. (Original) The apparatus of claim 15, wherein the apparatus is in a firewall 

20. (Currently amended) An apparatus for filtering content, comprising: 
assignment means for assigning point values to a plurality of keywords; 
first receipt means for receiving a request for a document from a client; 
second receipt means for receiving the document from a source; 
comparison means for comparing text of e ach of the plurality of documents the 

document with the plurality of keywords; 

calculation means for calculating a score for the document based on. the point 
values and the results of the comparison; 

determination means for determining if a decision interval has been reached; 

averaging means for calculating an average score over the decision interval if the 
decision interval has been reached for the source; and 

blocking means for blocking access to the source if the average score exceeds a 
threshold. 

21 . (Original) The apparatus of claim 20, wherein the keywords and corresponding 
point values are stored in a keyword search table. 

2.2. (Original) The apparatus of claim 20, wherein the decision interval is a length of 
time. 
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23. (Original) The apparatus of claim 20, wherein the decision interval is a number 
of documents. 

24. (Original) The apparatus of claim 20, wherein the blocking means comprises 
means for entering a known-block rule in a rules table, the known-block rule indicating 
that the source is to be blocked. 

25. (Original) The apparatus of claim 20, further comprising: 

means for entering a known-safe rule in a rules table if the first average score 
does not exceed the threshold, the known-safe rule indicating that access to the source is 
to be permitted. 

26. (Original) The apparatus of claim 20, further comprising: 

means for passing the document to the client if the decision interval has not been 
reached. 

27. (Original) The apparatus of claim 20, further comprising: 

means for passing the document to the client if the first average score does not 
exceed the threshold. 

28. (Original) A computer program product, in a computer readable medium, for 
filtering content, comprising: 

instructions for assigning point values to a plurality of keywords; 

instructions for receiving a first plurality of documents from a source; 

instructions for comparing text of each of the first plurality of documents with the 
plurality of keywords; 

instructions for calculating a score for each of the first plurality of documents 
based on the point values and the results of the comparison; 

instructions for calculating an first average of the scores for the first plurality of 
documents; and 
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instructions for blocking access to the source if the first average score exceeds a 
threshold. 

29- (Currently amended) A computer program product, in a computer readable 
medium, for filtering content, comprising: 

instructions for assigning point values to a plurality of keywords; 

instructions for receiving a request for a document from a client; 

instructions for receiving the document from a source; 

instructions for comparing text of each of the plurality of documonto the 
document with the plurality of keywords; 

instructions for calculating a score for the document based on the point values and 
the results of the comparison; 

instructions for determ ining if a decision interval has been reached; 

instructions for calculating an average score over the decision interval if the 
decision interval has been reached for the source; and 

instructions for blocking access to the source if the average score exceeds a 
threshold. 



Page 7 of 17 
Gusler et al. - 09/735,589 



PAGE 9/19 * RCVD AT 10/612004 2:03:53 PM [Eastern Daylight Time] * SVR:IISPTO£FXRM/0 " DNIS:8729306 " CSID:9723672008 * DURATION (mm-ss):05-20 



